海口招商建设有限公司网站,集团做网站需要多大的带宽,课程网站建设的设计报告,建筑铝模板多少钱一平方米概述#xff1a;用户态查看进程 PEB 和 TEB(通过windbg附加或启动调试的exe) 0x01 用户态查看 TEB 和 PEB
在双机调试的时候#xff0c;可以直接使用 !PEB PID 和 !TEB TID 获取进程和线程的相关信息#xff0c;在用户态这两个命令就会失效。原因就是用户态不支持大写的 !T… 概述用户态查看进程 PEB 和 TEB(通过windbg附加或启动调试的exe) 0x01 用户态查看 TEB 和 PEB
在双机调试的时候可以直接使用 !PEB PID 和 !TEB TID 获取进程和线程的相关信息在用户态这两个命令就会失效。原因就是用户态不支持大写的 !TEB 和 !PEB 命令。
在用户态调试时获取 teb 和 peb 的命令是小写的。
#获取 peb
!peb# 获取 teb
!teb除此之外这里提供另外一种思路。我们都知道 TEB 结构体中保存了PEB的地址因此可以通过TEB获取PEB的相关信息。
这里以 notepad.exe 为例演示。
0x02 演示
准备步骤
运行 notepad.exe WinR 输入 notepad 回车即可。运行 windbg并附加到进程 notepad.exe 上。
开始调试
查看当前线程
使用 ~. 查看当前线程(这里其实查看哪个线程都可以因为当前进程的 PEB 只有一个所有的 TEB 都指向了同一个 PEB)
0:007 ~.
. 7 Id: b8f4.d5a0 Suspend: 1 Teb: 000000a3b61d1000 UnfrozenStart: ntdll!DbgUiRemoteBreakin (00007ff9ab83c9c0)Priority: 0 Priority class: 32 Affinity: ff可以看到 Teb 地址为 000000 a 3 ‘ b 61 d 1000 000000a3b61d1000 000000a3‘b61d1000
查看TEB
dt ntdll!_Teb 000000a3b61d1000输出如下所示可以看到 0x060 偏移处为 _PEB
0:007 dt ntdll!_Teb 000000a3b61d10000x000 NtTib : _NT_TIB0x038 EnvironmentPointer : (null) 0x040 ClientId : _CLIENT_ID0x050 ActiveRpcHandle : (null) 0x058 ThreadLocalStoragePointer : (null) 0x060 ProcessEnvironmentBlock : 0x000000a3b61b8000 _PEB0x068 LastErrorValue : 00x06c CountOfOwnedCriticalSections : 00x070 CsrClientThread : (null) 0x078 Win32ThreadInfo : (null) 0x080 User32Reserved : [26] 00x0e8 UserReserved : [5] 00x100 WOW32Reserved : (null) 0x108 CurrentLocale : 0x8040x10c FpSoftwareStatusRegister : 00x110 ReservedForDebuggerInstrumentation : [16] (null) 0x190 SystemReserved1 : [30] (null) 0x280 PlaceholderCompatibilityMode : 0 0x281 PlaceholderHydrationAlwaysExplicit : 0 0x282 PlaceholderReserved : [10] 0x28c ProxiedProcessId : 00x290 _ActivationStack : _ACTIVATION_CONTEXT_STACK0x2b8 WorkingOnBehalfTicket : [8] 0x2c0 ExceptionCode : 0n00x2c4 Padding0 : [4] 0x2c8 ActivationContextStackPointer : 0x000000a3b61d1290 _ACTIVATION_CONTEXT_STACK0x2d0 InstrumentationCallbackSp : 00x2d8 InstrumentationCallbackPreviousPc : 00x2e0 InstrumentationCallbackPreviousSp : 00x2e8 TxFsContext : 0xfffe0x2ec InstrumentationCallbackDisabled : 0 0x2ed UnalignedLoadStoreExceptions : 0 0x2ee Padding1 : [2] 0x2f0 GdiTebBatch : _GDI_TEB_BATCH0x7d8 RealClientId : _CLIENT_ID0x7e8 GdiCachedProcessHandle : (null) 0x7f0 GdiClientPID : 00x7f4 GdiClientTID : 00x7f8 GdiThreadLocalInfo : (null) 0x800 Win32ClientInfo : [62] 00x9f0 glDispatchTable : [233] (null) 0x1138 glReserved1 : [29] 00x1220 glReserved2 : (null) 0x1228 glSectionInfo : (null) 0x1230 glSection : (null) 0x1238 glTable : (null) 0x1240 glCurrentRC : (null) 0x1248 glContext : (null) 0x1250 LastStatusValue : 00x1254 Padding2 : [4] 0x1258 StaticUnicodeString : _UNICODE_STRING 0x1268 StaticUnicodeBuffer : [261] 0x1472 Padding3 : [6] 0x1478 DeallocationStack : 0x000000a3b6400000 Void0x1480 TlsSlots : [64] (null) 0x1680 TlsLinks : _LIST_ENTRY [ 0x0000000000000000 - 0x0000000000000000 ]0x1690 Vdm : (null) 0x1698 ReservedForNtRpc : (null) 0x16a0 DbgSsReserved : [2] (null) 0x16b0 HardErrorMode : 00x16b4 Padding4 : [4] 0x16b8 Instrumentation : [11] (null) 0x1710 ActivityId : _GUID {00000000-0000-0000-0000-000000000000}0x1720 SubProcessTag : (null) 0x1728 PerflibData : (null) 0x1730 EtwTraceData : (null) 0x1738 WinSockData : (null) 0x1740 GdiBatchCount : 00x1744 CurrentIdealProcessor : _PROCESSOR_NUMBER0x1744 IdealProcessorValue : 0x30300000x1744 ReservedPad0 : 0 0x1745 ReservedPad1 : 0 0x1746 ReservedPad2 : 0x3 0x1747 IdealProcessor : 0x3 0x1748 GuaranteedStackBytes : 00x174c Padding5 : [4] 0x1750 ReservedForPerf : (null) 0x1758 ReservedForOle : (null) 0x1760 WaitingOnLoaderLock : 00x1764 Padding6 : [4] 0x1768 SavedPriorityState : (null) 0x1770 ReservedForCodeCoverage : 00x1778 ThreadPoolData : (null) 0x1780 TlsExpansionSlots : (null) 0x1788 DeallocationBStore : (null) 0x1790 BStoreLimit : (null) 0x1798 MuiGeneration : 00x179c IsImpersonating : 00x17a0 NlsCache : (null) 0x17a8 pShimData : (null) 0x17b0 HeapData : 00x17b4 Padding7 : [4] 0x17b8 CurrentTransactionHandle : (null) 0x17c0 ActiveFrame : (null) 0x17c8 FlsData : (null) 0x17d0 PreferredLanguages : (null) 0x17d8 UserPrefLanguages : (null) 0x17e0 MergedPrefLanguages : (null) 0x17e8 MuiImpersonation : 00x17ec CrossTebFlags : 00x17ec SpareCrossTebBits : 0y0000000000000000 (0)0x17ee SameTebFlags : 80x17ee SafeThunkCall : 0y00x17ee InDebugPrint : 0y00x17ee HasFiberData : 0y00x17ee SkipThreadAttach : 0y10x17ee WerInShipAssertCode : 0y00x17ee RanProcessInit : 0y00x17ee ClonedThread : 0y00x17ee SuppressDebugMsg : 0y00x17ee DisableUserStackWalk : 0y00x17ee RtlExceptionAttached : 0y00x17ee InitialThread : 0y00x17ee SessionAware : 0y00x17ee LoadOwner : 0y00x17ee LoaderWorker : 0y00x17ee SkipLoaderInit : 0y00x17ee SpareSameTebBits : 0y00x17f0 TxnScopeEnterCallback : (null) 0x17f8 TxnScopeExitCallback : (null) 0x1800 TxnScopeContext : (null) 0x1808 LockCount : 00x180c WowTebOffset : 0n00x1810 ResourceRetValue : (null) 0x1818 ReservedForWdf : (null) 0x1820 ReservedForCrt : 00x1828 EffectiveContainerId : _GUID {00000000-0000-0000-0000-000000000000}查看PEB
dt ntdll!_PEB 0xa3b61b8000# 或者使用 dx 命令
dx -r1 ((ntdll!_PEB *)0xa3b61b8000)输出如下所示到此就看到了 notepad 的 PEB 了。后文补充了 PEB 结构体中 ProcessParameters 变量的分析和查看。
0:007 dt ntdll!_PEB 0xa3b61b80000x000 InheritedAddressSpace : 0 0x001 ReadImageFileExecOptions : 0 0x002 BeingDebugged : 0x1 0x003 BitField : 0x84 0x003 ImageUsesLargePages : 0y00x003 IsProtectedProcess : 0y00x003 IsImageDynamicallyRelocated : 0y10x003 SkipPatchingUser32Forwarders : 0y00x003 IsPackagedProcess : 0y00x003 IsAppContainer : 0y00x003 IsProtectedProcessLight : 0y00x003 IsLongPathAwareProcess : 0y10x004 Padding0 : [4] 0x008 Mutant : 0xffffffffffffffff Void0x010 ImageBaseAddress : 0x00007ff77ef80000 Void0x018 Ldr : 0x00007ff9ab8db4c0 _PEB_LDR_DATA0x020 ProcessParameters : 0x000001a650d52540 _RTL_USER_PROCESS_PARAMETERS0x028 SubSystemData : 0x00007ff99f7af1d0 Void0x030 ProcessHeap : 0x000001a650d50000 Void0x038 FastPebLock : 0x00007ff9ab8db0e0 _RTL_CRITICAL_SECTION0x040 AtlThunkSListPtr : (null) 0x048 IFEOKey : (null) 0x050 CrossProcessFlags : 10x050 ProcessInJob : 0y10x050 ProcessInitializing : 0y00x050 ProcessUsingVEH : 0y00x050 ProcessUsingVCH : 0y00x050 ProcessUsingFTH : 0y00x050 ProcessPreviouslyThrottled : 0y00x050 ProcessCurrentlyThrottled : 0y00x050 ProcessImagesHotPatched : 0y00x050 ReservedBits0 : 0y000000000000000000000000 (0)0x054 Padding1 : [4] 0x058 KernelCallbackTable : 0x00007ff9a9a80070 Void0x058 UserSharedInfoPtr : 0x00007ff9a9a80070 Void0x060 SystemReserved : 00x064 AtlThunkSListPtr32 : 00x068 ApiSetMap : 0x000001a650c80000 Void0x070 TlsExpansionCounter : 00x074 Padding2 : [4] 0x078 TlsBitmap : 0x00007ff9ab8db440 Void0x080 TlsBitmapBits : [2] 0xffffffff0x088 ReadOnlySharedMemoryBase : 0x00007df43dce0000 Void0x090 SharedData : (null) 0x098 ReadOnlyStaticServerData : 0x00007df43dce0750 - (null) 0x0a0 AnsiCodePageData : 0x00007df53fe30000 Void0x0a8 OemCodePageData : 0x00007df53fe30000 Void0x0b0 UnicodeCaseTableData : 0x00007df53fe60028 Void0x0b8 NumberOfProcessors : 80x0bc NtGlobalFlag : 00x0c0 CriticalSectionTimeout : _LARGE_INTEGER 0xffffe86d079b80000x0c8 HeapSegmentReserve : 0x1000000x0d0 HeapSegmentCommit : 0x20000x0d8 HeapDeCommitTotalFreeThreshold : 0x100000x0e0 HeapDeCommitFreeBlockThreshold : 0x10000x0e8 NumberOfHeaps : 60x0ec MaximumNumberOfHeaps : 0x100x0f0 ProcessHeaps : 0x00007ff9ab8d9d40 - 0x000001a650d50000 Void0x0f8 GdiSharedHandleTable : 0x000001a651120000 Void0x100 ProcessStarterHelper : (null) 0x108 GdiDCAttributeList : 0x140x10c Padding3 : [4] 0x110 LoaderLock : 0x00007ff9ab8d55c8 _RTL_CRITICAL_SECTION0x118 OSMajorVersion : 0xa0x11c OSMinorVersion : 00x120 OSBuildNumber : 0x4a650x122 OSCSDVersion : 00x124 OSPlatformId : 20x128 ImageSubsystem : 20x12c ImageSubsystemMajorVersion : 0xa0x130 ImageSubsystemMinorVersion : 00x134 Padding4 : [4] 0x138 ActiveProcessAffinityMask : 0xff0x140 GdiHandleBuffer : [60] 00x230 PostProcessInitRoutine : (null) 0x238 TlsExpansionBitmap : 0x00007ff9ab8db420 Void0x240 TlsExpansionBitmapBits : [32] 10x2c0 SessionId : 10x2c4 Padding5 : [4] 0x2c8 AppCompatFlags : _ULARGE_INTEGER 0x00x2d0 AppCompatFlagsUser : _ULARGE_INTEGER 0x00x2d8 pShimData : 0x000001a650cc0000 Void0x2e0 AppCompatInfo : (null) 0x2e8 CSDVersion : _UNICODE_STRING 0x2f8 ActivationContextData : 0x000001a650cb0000 _ACTIVATION_CONTEXT_DATA0x300 ProcessAssemblyStorageMap : 0x000001a650d5b5c0 _ASSEMBLY_STORAGE_MAP0x308 SystemDefaultActivationContextData : 0x000001a650ca0000 _ACTIVATION_CONTEXT_DATA0x310 SystemAssemblyStorageMap : (null) 0x318 MinimumStackCommit : 00x320 SparePointers : [4] (null) 0x340 SpareUlongs : [5] 00x358 WerRegistrationData : 0x000001a652e00000 Void0x360 WerShipAssertPtr : (null) 0x368 pUnused : (null) 0x370 pImageHeaderHash : (null) 0x378 TracingFlags : 00x378 HeapTracingEnabled : 0y00x378 CritSecTracingEnabled : 0y00x378 LibLoaderTracingEnabled : 0y00x378 SpareTracingBits : 0y00000000000000000000000000000 (0)0x37c Padding6 : [4] 0x380 CsrServerReadOnlySharedMemoryBase : 0x00007df466cb00000x388 TppWorkerpListLock : 00x390 TppWorkerpList : _LIST_ENTRY [ 0x000000a3b5f0f860 - 0x000000a3b63ffb70 ]0x3a0 WaitOnAddressHashTable : [128] (null) 0x7a0 TelemetryCoverageHeader : (null) 0x7a8 CloudFileFlags : 0xe00x7ac CloudFileDiagFlags : 00x7b0 PlaceholderCompatibilityMode : 2 0x7b1 PlaceholderCompatibilityModeReserved : [7] 0x7b8 LeapSecondData : 0x00007df53fe20000 _LEAP_SECOND_DATA0x7c0 LeapSecondFlags : 00x7c0 SixtySecondEnabled : 0y00x7c0 Reserved : 0y0000000000000000000000000000000 (0)0x7c4 NtGlobalFlag2 : 0查看 ProcessParameters
为了进一步了解和查看这里再查看 ProcessParameters 的变量。
查看 PEB 的输出可以看到 ProcessParameters 的结构体名为 _RTL_USER_PROCESS_PARAMETERS该结构体保存了进程很多基础信息如环境变量、命令行等等。查看当前 ProcessParameters
dx -r1 ((ntdll!_RTL_USER_PROCESS_PARAMETERS *)0x1a650d52540)# 或者
dt _RTL_USER_PROCESS_PARAMETERS 0x1a650d52540输出如下所示
0:007 dt _RTL_USER_PROCESS_PARAMETERS 0x1a650d52540
ntdll!_RTL_USER_PROCESS_PARAMETERS0x000 MaximumLength : 0x78a0x004 Length : 0x78a0x008 Flags : 0x60010x00c DebugFlags : 00x010 ConsoleHandle : (null) 0x018 ConsoleFlags : 00x020 StandardInput : (null) 0x028 StandardOutput : (null) 0x030 StandardError : (null) 0x038 CurrentDirectory : _CURDIR0x050 DllPath : _UNICODE_STRING 0x060 ImagePathName : _UNICODE_STRING C:\WINDOWS\system32\notepad.exe0x070 CommandLine : _UNICODE_STRING C:\WINDOWS\system32\notepad.exe 0x080 Environment : 0x000001a650d50fe0 Void0x088 StartingX : 00x08c StartingY : 00x090 CountX : 00x094 CountY : 00x098 CountCharsX : 00x09c CountCharsY : 00x0a0 FillAttribute : 00x0a4 WindowFlags : 0x8010x0a8 ShowWindowFlags : 10x0b0 WindowTitle : _UNICODE_STRING C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk0x0c0 DesktopInfo : _UNICODE_STRING Winsta0\Default0x0d0 ShellInfo : _UNICODE_STRING 0x0e0 RuntimeData : _UNICODE_STRING 0x0f0 CurrentDirectores : [32] _RTL_DRIVE_LETTER_CURDIR0x3f0 EnvironmentSize : 0x154e0x3f8 EnvironmentVersion : 30x400 PackageDependencyData : (null) 0x408 ProcessGroupId : 0x3ec0x40c LoaderThreads : 00x410 RedirectionDllName : _UNICODE_STRING 0x420 HeapPartitionName : _UNICODE_STRING 0x430 DefaultThreadpoolCpuSetMasks : (null) 0x438 DefaultThreadpoolCpuSetMaskCount : 00x43c DefaultThreadpoolThreadMaximum : 0到这一步基本上进程的详细信息就都可以看到了。如果是 windbg preview 版本点几下就能看到一些信息但是 Environment 环境变量是一个指针如果需要查看还是需要输入命令才行。
查看 Environment
在 _RTL_USER_PROCESS_PARAMETERS 结构中有三个成员与 Environment 相关
# 指向环境变量的指针
0x080 Environment : 0x000001a650d50fe0 Void# 环境变量的大小
0x3f0 EnvironmentSize : 0x154e# 环境变量的版本
0x3f8 EnvironmentVersion : 3通过环境变量指针和大小我们就可以看到环境变量的内容了
db 0x000001a650d50fe0 l 0x154e
